This message was deleted.

I wrote a systemd timer to grab it every hour or so, I wish it was built into puppetserver that if it isn't a CA it syncs the CA CRL every once in a while

a compiler isn't aware of other servers, so it cannot sync automatically

except at the same time, the puppetserver won't start without the crl

yeah that's a different story

I do too, but my CA isn't also a compiler, so I use puppet apply as an initial install step

After spending some time with this yesterday I think I was in a tight grip of a misunderstanding on how CRLs work. I thought that when a puppet agent initiates a run and contacts the puppet server, the latter checks the agent against the CRL. For that reason I wanted to make sure that the servers had the latest CRL. What seems to really be happening is that like in any SSL handshake, the onus of checking the CRL is on the client. I noticed for example that if you delete the CRL from the client, it will retrieve it from the CA — the puppet server (compile master) is hands off in that process. Are my conclusions correct?

yes, the agent requests an update to the crl once every crl_refresh

https://www.puppet.com/docs/puppet/7/configuration.html#crl-refresh-interval

By default the CRL is only downloaded once, and never refreshed

I want to say that changed

i was surprised because i definitely see crls that are back from 2021 in my environment

crl_refresh_interval is available since puppet 7 and enabled by default in puppet 8

do you guys know if a jruby worker is used to serve the CRL?

yes

bummer, this could be a problem with a large number of clients

works well with a few 10k nodes

it'd be a very short worker time honestly

unless you have a function with memory leaks, I recommend to not flush the workers

Hmm, how would a proxy work? It would need to run on a different port and the client would need to be aware of it somehow?

you'd stick nginx in front of puppet and set it to cache the crl for X minutes

Oh, you’re right, in fact it could intercept that particular path and serve it directly?

yes

Actually, I’m scratching my head over the purpose of the CRL. Usually it’s for CAs to publish the ids of the revoked certs for the client to abort connecting to a server whose cert id is on the CRL. In the context of the puppet server though, we have agents connecting to compile masters — should the CRL only contain possibly revoked certs of one or more compile masters?

you can also use the ca against other systems (monitoring etc) and so having a global crl sync can be useful

ok, but it shouldn’t be used to contain revoked agent certs right?

I would think it should (and I think it does)

right it does, but what for is my question

if there's anything other then puppet using the ca? (which is a thing), and I am pretty sure the standard says all revoked certs are in the crl

nothing else uses the CA

for you

puppet to puppet

we use it for zabbix too

yes, i meant for me

not that I am aware of, but the crl is tiny, even if you have 1000s of revokes

there is also an option of have an infra CRL, which is shorte

It's not needed, that's the point of the document

my experience shows that if an agent’s cert is on the CRL and the CRL is given to the agent, the agent will refuse to run with a message (in red) saying that the signature of the cert is wrong

I'm not 100% sure, but that behaviour is likely